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ABSTRACT 


Data integrity credential is a good stride to the pharmaceutical industry and 
also helps for the prospective market growth of the industry by increasing the 
public trust, reputation. Data integrity is a head way for maintaining quality 
systems and controlling deviations, minimizing errors that occur frequently in 
the industry. It ensures the lab records and good outcome in inspections, 
audits, and to get excellent market division in terms of share and also makes 
the industry flawless. Data integrity includes the complete, consistent data 
that should be attributable, legible, contemporaneous, and original, accurate 
data and should be recorded and maintained in-depth periodically. This article 
mainly emphasizes on the approaches for data integrity, background, 
challenges faced by company, consequences of data integrity failures, 
remediation measures for data integrity, new FDA (Food and Drug 
Administration] guidelines on data integrity.ln order to ensure data integrity 
in industry quality culture should be maintained, electronic signatures, 
personnel, giving training to employees to ensure quality system in the 
industry. 
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INTRODUCTION 

Data Integrity: Data Integrity refers to the extent to which 
the data is complete, consistent and accurate throughout the 
data lifecycle. Data includes all original records and true 
copies, including raw data, metadata and all subsequent 
transformations and reports of the data. [1, 2] 
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The warning letters are under the control of the CDER 
(Centre for Drug Evaluation and Research] and in office of 
regulatory affairs under the division of pharmaceutical 
quality programs. The data integrity process followed by 
FDA is shown in the Fig.l. 




Attributable 


who acquired the data or performed an action 
and when was it acquired? 


Legible 


data mirst be legible foiinat and peiinanent 
druing the entire retention time. 


* docrmiented at the time of the activity 


Contemporaneous 


Original 


Accurate 


♦ raw data or soiuce data nrust be available in 
original form or hire copy 

* data rimst contain context/meaning and 
metadata 


Fig. 1: Data integrity follows ALCOA 
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Why is data integrity needed? 

1. It assures the quality, safety and efficacy of the drugs. 

2. The documented data is the only record of the activity presenting the quality of the product. 

3. Reliability of the data presented. 

4. Submitting false data to the FDA is a criminal violation under FD&C act [CGMP/adulteration provisions] 

Metadata: 

metadata is structured information that describes, explains, or otherwise makes it easier to retrieve, use, or manage data. 
Metadata is often described as data about data. Data should be maintained throughout the record's retention period with all 
associated metadata required to reconstruct the CGMP activity (e.g., §211.188, 211.94].the relationships between data and 
their metadata should be preserved in a secure and traceable manner. 

Audit trail: 

audit trail means a secure, computer-generated, time-stamped electronic record that allows for reconstruction of the course of 
events relating to the creation, modification, or deletion of an electronic record. 

Audit trails include those that track creation, modification, or deletion of data and those that track actions at the record or 
system level. 

CGMP-complaint record-keeping practices prevent data from being lost or obscured and ensure that activities are documented 
at the time of performance (§§ 211.68,211.100,211.160(a], 211.188 and 211.194].electronic record-keeping systems, which 
include audit trails, can support these CGMP requirements. 

Static record format: 

static is used to indicate a fixed data record such as paper record or electronic image. 

Dynamic record format: dynamic means that the record format allows interaction between the user and the record content. 

Backup data: according to §211.68(b] backup refers to a true copy of the original record that is maintained securely 
throughout the record retention period (e.g., §211.180]. 

The backup file should contain the data along with metadata and should be in original format and compatible with the original 
format.FDA uses the term “backup" as it is consistent with the term archive as used in guidance for industry and FDA staff 
General Principles of Software Validation. Temporary backup copies (e.g., in case of a computer crash or other interruption] 
would not satisfy the requirement in §211.68(b] to maintain a backup file of data. 

Computer related systems: the American national standards institute(ANSI] computer related systems can refer to computer 
hardware, software, peripheral devices, networks, cloud infrastructure, personnel, and associated documents(e.g., user 
manuals and standard operating procedures].[3] 

Regulations and Guidelines of Data Integrity: 

21 CFR Part 11- Electronic records and electronic signatures 

21 CFR Part 210- cGMP in manufacturing, processing, packing and holding of drugs, generalDraft Guidance- Data Integrity and 
compliance with cGMP 

21 CFR Part 211- cGMP for finished pharmaceuticals 

§211.68 requires that backup data are complete and accurate and secure from alteration, inadvertent loss 
§212.110(b] requires that data be stored to prevent deterioration or loss 

§211.100 and 211.160 require that certain activities are to be documented at the time of performance and that laboratory 
controls should be scientifically strong. 

§211.180 requires true copies or other accurate reproductions of the original records and; 

§211.188, 211.194 and 212.60(g] require complete information, complete data derived from all tests, complete record of all 
data, and complete records of all tests performed. 

APIs-ICH Q7: 

> Computerized systems (5.4]: GMP-related computerized systems should be validated. 

> Appropriate installation and operational qualifications should demonstrate the suitability of computer hardware and 
software to perform assigned tasks. 

> Incidents related to computerized systems that could affect the quality of intermediates or APIs or the reliability of records 
or test results should be recorded and investigated. 
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FORM 483: 

An FDA Form 483 is issued to firm management at the conclusion of an inspection when an investigator has observed any 
conditions that in their judgment may constitute violations of the Food Drug Cosmetic [FD&C] Act and related acts.FDA 
investigators are trained to ensure that each observation noted on the FDA Form 483 is clear, specific and significant. 

The purpose of Form 483 is to encourage companies to respond to FDA Form 483 in writing with their corrective action plan 
and then implement that corrective plan expeditiously. FDA Form 483 notifies the company's management of objectionable 
conditions. At the conclusion of an inspection, the FDA Form 483 is presented and discussed with the company's senior 
management. 

Close out letter: 

a close out letter will be issued by FDA based on its evaluation; the firm has taken corrective action to address the violations 
contained in the warning letter. This process applies to warning letters issued on or after September 1, 2009.the corrective 
actions must be actually have been made and verified by FDA. Usually, the standard for verifying that corrections have been 
implemented will be a follow-up inspection. If the warning letter contains violations that by their nature are not correctable, 
then no close-out letter will be issue. [4] 

Import alerts:import alerts inform the FDA's field staff and the public that the agency has enough evidence to allow for 
Detention without Physical Examination [DWPE] of products that appear to be in violation of the FDA's laws and regulations. 

The purpose of an import alerts is to: 

> Prevent potentially violative products from being distributed in the United States. 

> Free-up agency resources to examine other shipments 

> Provide uniform coverage across the country 

> Place the responsibility back on the importer to ensure that the products being imported in to the United states are in 
compliance with the FDA's laws and regulations.[5] 

Background: 

Data integrity assurance is a component of data management and equally applies to paper records and electronic records. The 
“generics scandal'' of the 1980's raised the issue of falsified data submitted to FDA in support of drug approvals. One outcome of 
this scandal was the shift in focus of the FDA pre-approval inspection (PAI] to evaluate raw laboratory data included in the 
marketing application and evaluate whether the site was capable of manufacture as described in the application. This scandal 
also promoted implementation of the application integrity policy in 1991 which “describes the agency's approach regarding the 
review of applications that may be affected by wrongful acts that raise significant questions regarding data reliability.[6] 

FDA recognized the increased reliance on computerized systems within the pharmaceutical industry. They developed and 
published 21CFR Part 11, the final rule on electronic records and electronic signatures in 1997.in 2003 FDA published a 
guidance for industry, part 11, electronic records; electronic signatures-scope and application to address enforcement 
priorities.FDA continues to communicate their interpretations in compliance actions such as Form 483, warningletters, podium 
presentations and on their Q&A website page. 

How can we find warning letters in FDA official page? 

> Firstly in FDA's electronic reading room we should search based on some keywords 

> Then we should select the “sort by'' -means by date, or by month etc. 

> Then we should proceed to the “select sort criteria''- like ascending or descending order. 

> Then select “GO" 

> We should select “ALL" to view pages relating to the warning letters 

> Select warning letters to open-use ctrlF to find key words 

Example of warning letter: 

This is a warning letter issued by USFDA to Reine life science, Gujarat, India last year in MAY, 2019. 

Stating that “failure to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to 
data, and failure to have adequate controls to prevent omission of data''. 

FDA mentioned in the warning letter as: 

Our investigator observed that the audit trail feature was disabled on instruments you use for quality control testing of your 
API, including your high performance liquid chromatographic system. Your analytical systems also lacked controls to prevent 
users from deleting or altering electronic data. For example, your quality assurance executive, who also performed your 
analytical tests,had administrator access to each system. 

In your response, you committed to validating all computerized systems with incorporation of audit trails, restrictions on data, 
and user-access controls by March 31, 2018. 
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Your response is insufficient because it does not include interim control measures and procedural changes for the control and 
review of analytical data. You also do not specify who will have administrator privileges on your analytical instrument systems 
used for cGMP quality control testing. 

In response to this letter: 

> Provide a summary of your interim controls to prevent deletion and modification of data, 

> Define the roles and responsibilities of personnel who have access to analytical instruments and data, 

> Provide a standard operating procedure (SOP] that ensures that all quality control tests are performed by an analyst and 
receive second-tier review (e.g., by a manager] from a separate individual; 

> Detail the associated user privileges for each analytical system; 

> Provide a detailed summary of your procedural updates and associated training for user role assignment and controls; and 

> Provide detailed procedures for your review of audit trail data 


Challenges faced by the company are shown in fig.2. 


challenges to quality and data integiity in to an organisational stnicture 


limited awareness and training 


•insufficient controls and inefficient business processes/systems 


•contracting or outsoiucing work to a tliir d paity vendor 


•data vohunes and complexity 


Fig.2: Key Challenges Company is facing in implementing data integrity 


Common data integrity violations: 

> Failure to maintain complete data derived from all laboratory tests conducted to ensure compliance with established API 
standards, e.g.: this failure included the discovery of residual solvent testing data in the recycle bin folder, and failure to 
retrieve test data upon request.[7] 

> Failure to prevent unauthorized access or changes data, and failure to provide adequate controls to prevent omission of 
data. This failure in one case, included the discovery that chromatography metadata (e.g.: time and data] could be changed 
without the changes being reflected in the audit trail. In another case, analysts deleted unknown peaks without 
justification, making the drugs in question paper to conform to their specifications. One of these peaks was for a residual 
solvent known to be a genotoxic impurity. [8] 

> Failure to record activities at the time they are performed and destruction of original records. In one case, this failure 
involved the back dating of batch production records, and the destruction of original records after being manually 
transcribed. [9] 

> Failure to train employees on their particular operations and related CMP practices.eg includes the declaration by 
employees that they had not received training for their production operations. The company in question was not able to 
produce any training reports for inspectors, despite the generation of training reports being part of company policy. [10] 


Consequences of data integrity failure: 

Data integrity can result in the following regulatory and non regulatory consequences: [11] 

> The regulatory body can, at its own discretion, punish even technical violations which may not result in obvious threats to 
patient health. In addition to warning letters, the available enforcement actions include approval withdrawals, plant 
shutdowns, injunctions or penalties and debarment of individuals. The regulatory body has also resorted to suspending 
drug sales when it discovered that the integrity of the underlying data was compromised. [12,13] 

> Criminal enforcement- the New England compounding centre manufactured drug products that resulted in a number of 
individuals dying from meningitis. During an inspection by a regulatory agency, the investigators found numerous cases of 
negligence and data integrity issues, for example, falsified cleaning logs to show cleaning was performed when it was not 
performed. Following the investigation, criminal charges were filed against 14 employees from high level executives to 
operators in the clean room.convition on these types of charges can result in prison terms in addition to large fines.[14] 
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> Loss of reputation and public trust- the publication of warning letters in newspapers and consumer domains, can 
significantly tarnishes the reputations of a company. There have recently also been high profile warning letters from the 
regulatory body for a serious GMP violations which can result in adverse publicity.[15].organization's approach in 
implementing data integrity is shown in the fig.S.the risk factors are shown in the Fig.4. 



Fig.3: Organization's approach in implementing data integrity 

I * giving tiaimng to employees :data handling and reporting 
• eveiyone in the company are equally responsible for data 

I •computer systems should be vahdated 

•identifying the ciitical data records and backup and recoveiy 

I •control of access on users, passwords etc. 

•cyber secuiity should be present 

I •audits and mspections should mclude reviews for data mtegiity controls. 

" • 

•regulating the hfe of data: data creation, review, approval,storage,obsolete 

•peiiochc aucUts should be conducted to confhin adlierence to estabhshed 
requiiements for data integrity 

•track actions of users, reviewers and approvers reviewed, defined in user operational 
SOP 

I •consider the design, operation and monitoring of processes 
Fig.4: Data Integrity Risk Factors 


data review 


govemance/findings 


external sources 


document control 



security control 


Personnel 


V ahdation 


Implementing Data Integrity: 

> Record all the data in contemporaneous manner and sign 

> Enter the data and time as per procedure 

> Errors if any should be corrected as per Good Distribution Practices 

> Any changes should be noted with reason 
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> Data should reflect the person who performed the activity or entered the results or verified the accuracy of entries. Never 
record the signature of another person 

> Never pre-date or back date entries on any record 

> Computer system shall be trustworthy, validated, ensure access control and audit trail 

> QMS Modernization 

> Computer system validation 

> Quality risk management processes 

> Strengthen internal audit 

> Identifying risk factors 

> Technical/QA/training/Education 

> Promoting and supporting quality culture 

> Effective CAPA assessment 

> Control of documents/records 

Data Integrity Remediation: 

FDA warning letter recommendations: 

1. investigate extent: investigate extent includes 

> Scope of investigation protocol/methodology 

> Root cause: interview current employees/former employees 

> Report all deficiencies: extent 

> Third party: deeper investigation of breaches 

2. risk assessment: it includes 

> On drug quality: impact of data integrity lapses 

3. management strategy: it is very much important and should be considered for future purposes 

> To ensure reliability and completeness: detailed corrective action 

> Root causes: comprehensive description 

> Actions: interim measures and long term measures 

> Report the status 

> The FDA regulators want that there should be no data- falsification, omission, hiding, and substitution. 

> perform GAP analysis 

> implement a corrective action plan(global] & prevent the integrity 

> Remove the individuals responsible for problems from cGMP positions 

> Complete a satisfactory inspection 

> increase the frequency of review 

> do surprise or spot checks 

> have a checklist for review mechanism 

> compare hand writing styles and signatures 

> verify attendance and presence of the persons 

> verify the traceability and logbook entries 

> trend the observations and provide the training 

> Define a clear policy on various activities like password policy 

> Have a clear procedure and controls over the electronic data and software administration 

> Cross check privileges and job responsibilities 

> Check the adequacy of the procedures. 

The graphs representing the warning letters on data integrity and deviations are shown in fig.5 respectively. 


Deviations 

■ Documentation ■ Quality systems ■ OOS 

■ FORM 483 BCAPA ■ Others 



Fig. 5: Bar graph depicting the deviations in data integrity observed by USFDA 
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CONCLUSION: 

Data integrity is a crucial part in industry in maintaining the 
data during the regulatory audits. Data integrity is attained 
by having data recorded and documented and ensuring 
quality systems to be maintained. The perfect strategic 
planning ensures the audit trails, internal assessment of 
records, training of employees, electronic signatures, data 
review etc.data integrity mainly occurs due to improper 
documentation ofrecords, lack of quality system, inadequate 
control over computer systems, unauthorized access to 
accounts. Form 483, lack of inspectional observations, 
corrective and preventive action measures are not properly 
implemented. To ensure successful implementationof data 
Integrity Company should maintain quality culture to get 
reputation, trust and market valueand confidence of 
regulators and successful business organizations.In this we 
have observed that U.S have received more warning letters 
when compared to other countries and the number is 
enormously increasing day-by-day. 
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